Edit tour

Windows Analysis Report
http://japaneastr-notifyp.svc.ms

Overview

General Information

Sample URL:	http://japaneastr-notifyp.svc.ms
Analysis ID:	1546688
Infos:

Detection

Score:	21
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

AI detected suspicious URL

HTTP GET or POST without a user agent

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 600 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 2396 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1948,i,5061841531020221121,2327678435773558814,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6576 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://japaneastr-notifyp.svc.ms" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T13:25:11.358648+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.17	49706	TCP
2024-11-01T13:25:49.997928+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.17	49728	TCP

HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.17:49706
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.17:49728

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: japaneastr-notifyp.svc.msConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: japaneastr-notifyp.svc.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://japaneastr-notifyp.svc.ms/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Fhu1zghkpZcNugC&MD=TsMgzCSK HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIk6HLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: japaneastr-notifyp.svc.msConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: -240X-DeviceID: 01000A41090080B6X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDoAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAXnD9znpb9bazssWWcPEhbKTEo4EBraWqNQxbbxr4OXSdctfq1/JUmuJ23/W8X1Ol1ksdsm9ppva66Iui1zF1XKBMs0O6/3e/ESB4ofDAdl2k9F1um7SbjWwIHRXjLnjd2N95FjSZYkAJSTKSsSWmEjKtEWUxpHrbrC8/v8T4n54H0jRSzYwsgI/YP8VgkkCOKJZXdg8tBVILn2CC9tLLyj4NNvtiSVhZsJ2M6SulpNtEiP2vHAb6cQFncivv8Hjfp%2B7aiQnGIS18tV5%2B3Kw9RsKohINVw3nBH9thB4/OkQ/rsZqw7zKUVdxNg1gXseT5PIdc5c41doB52yeWQHs2YwQZgAAENtwR4UZiZM3KgxitKz5lL6wAYfDiE4EJ4HycjR/LAMozl5XpdOZJDblNSW7Hxg436ui/C0IzPzwTksZnfbTogiUxeV1wRN/UpPaKJ9z8vL4oVi%2BWCeMsNra4Fp3VsLhmYA9U7SO5ihs7j4KlZSbYOKgFhMC79t9VQNeEAmS6r8mW7W0ZV2yl9j%2B821mGBaUlrEsibAekRDBPVkSpuhnDBCn7b4sJaO1OddT15AKAzJ6LBHfrsH4UejQFFfYByXDWOB0En9puA8E9W6h1jDSaR0Cf2fcFnt38KvDrrM%2BLENIHYTCX1onMcUNSAHfstJczxmL3gdezpInxVGR0RETrSKjDPPgigHq3s%2B2wtbyNbGYGPl9tpcPeXpn06eEobYwLygtsDNh0JVZP5LOknQlerJpOJSvxWtVbL/LSJ26wDD076MS7VPqkJklzL0cu8fNIDPLuMbhXhgHmK/Z1N2utMCnajGjHRnTWjTGEeOi0XIYcEP3KIFJhnm1uYCO8tQsSAeWTIhcwr32FqbgJnZ/pIXPAkUQCWnGB5z6Y1LKyiSFnL0aU8wCs8inUv%2Bea40njCEgiWJ3LsmPxvGUnLR9JOhhjtoB%26p%3DX-Agent-DeviceId: 01000A41090080B6X-BM-CBT: 1730463935User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: 94019375A7EB4214A741A5FAF82576CAX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
Source: global traffic	HTTP traffic detected: GET /serve_file/@e3344ddefa12e60436fa28c81cf207c1afb4d0a9/third_party/vscode.web-custom-data/browsers.css-data.json HTTP/1.1Host: chrome-devtools-frontend.appspot.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Fhu1zghkpZcNugC&MD=TsMgzCSK HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIk6HLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: japaneastr-notifyp.svc.msConnection: keep-alivePragma: no-cacheCache-Control: no-cachesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: japaneastr-notifyp.svc.msConnection: keep-alivePragma: no-cacheCache-Control: no-cachesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: japaneastr-notifyp.svc.ms
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: chrome-devtools-frontend.appspot.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 1245Content-Type: text/htmlX-Powered-By: ASP.NETX-Cache: CONFIG_NOCACHEX-MSEdge-Ref: Ref A: 8C3A4AE6D18B41C2B8CC563EAEAAFFF8 Ref B: DFW311000108049 Ref C: 2024-11-01T12:25:04ZDate: Fri, 01 Nov 2024 12:25:04 GMTConnection: close

Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Gecko/Chrome/CSS/overflow-clip-box
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/:placeholder-shown
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/:playing
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/offset-position
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/offset-rotate
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/overflow-anchor
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/overflow-block
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/overflow-clip-margin
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/overflow-inline
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/overscroll-behavior
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/overscroll-behavior-block
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/overscroll-behavior-inline
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/overscroll-behavior-x
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/overscroll-behavior-y
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/scroll-margin
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/scroll-margin-block
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/scroll-margin-block-end
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/scroll-margin-block-start
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/scroll-margin-bottom
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/scroll-margin-inline
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/scroll-margin-inline-end
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/scroll-margin-inline-start
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/scroll-margin-left
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/scroll-margin-right
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/scroll-margin-top
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/scroll-snap-stop
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/scroll-snap-type-x
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/scroll-snap-type-y
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/scroll-timeline
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/scroll-timeline-axis
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/scroll-timeline-name
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/text-combine-upright
Source: chromecache_68.1.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/CSS/text-decoration-skip

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.14:443 -> 192.168.2.17:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.123.104.21:443 -> 192.168.2.17:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49728 version: TLS 1.2

Source: classification engine

Classification label: sus21.win@20/12@12/6

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1948,i,5061841531020221121,2327678435773558814,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://japaneastr-notifyp.svc.ms"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1948,i,5061841531020221121,2327678435773558814,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Persistence and Installation Behavior

AI detected suspicious URL

Source: Email	JoeBoxAI: AI detected Brand spoofing attempt in URL: URL: http://japaneastr-notifyp.svc.ms
Source: Email	JoeBoxAI: AI detected Typosquatting in URL: URL: http://japaneastr-notifyp.svc.ms

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Name	IP	Active	Malicious	Reputation
dual-spo-0005.spo-msedge.net	13.107.136.10	true	false	unknown
chrome-devtools-frontend.appspot.com	142.250.186.52	true	false	unknown
www.google.com	142.250.186.68	true	false	unknown
japaneastr-notifyp.svc.ms	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
https://japaneastr-notifyp.svc.ms/favicon.ico	false	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	unknown
https://chrome-devtools-frontend.appspot.com/serve_file/@e3344ddefa12e60436fa28c81cf207c1afb4d0a9/third_party/vscode.web-custom-data/browsers.css-data.json	false	unknown
https://japaneastr-notifyp.svc.ms/	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://developer.mozilla.org/docs/Web/CSS/:placeholder-shown	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/scroll-timeline	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/text-decoration-skip	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/scroll-timeline-axis	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/overflow-block	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/scroll-margin-block	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Mozilla/Gecko/Chrome/CSS/overflow-clip-box	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/overflow-anchor	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/scroll-snap-stop	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/overscroll-behavior-inline	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/offset-position	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/scroll-margin-block-end	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/scroll-margin-inline-start	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/overflow-inline	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/overscroll-behavior-block	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/scroll-snap-type-y	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/scroll-timeline-name	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/scroll-margin-inline-end	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/offset-rotate	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/scroll-margin	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/scroll-snap-type-x	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/scroll-margin-bottom	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/overflow-clip-margin	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/scroll-margin-inline	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/text-combine-upright	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/scroll-margin-block-start	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/overscroll-behavior	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/:playing	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/scroll-margin-left	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/overscroll-behavior-x	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/overscroll-behavior-y	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/scroll-margin-right	chromecache_68.1.dr	false	unknown
https://developer.mozilla.org/docs/Web/CSS/scroll-margin-top	chromecache_68.1.dr	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.52	chrome-devtools-frontend.appspot.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546688
Start date and time:	2024-11-01 13:24:28 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://japaneastr-notifyp.svc.ms
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus21.win@20/12@12/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, TextInputHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.35, 142.250.186.78, 74.125.133.84, 34.104.35.123, 192.229.221.95, 46.228.146.0, 142.250.185.227, 2.19.126.137
Excluded domains from analysis (whitelisted): www.bing.com, clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, login.live.com, evoke-windowsservices-tas.msedge.net, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://japaneastr-notifyp.svc.ms

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 1 11:25:03 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.979846637318683
Encrypted:	false
SSDEEP:	48:8F1dmTX7skH9idAKZdA1JehwiZUklqehBy+3:8Fusqey
MD5:	AB2B4970AF3C4073E1E46515AC39F581
SHA1:	466C08E25123CBD54F28F69B304ACF0C6483CC91
SHA-256:	6C273CF6E5CF93BFF972A11EA2D0040F201804FC61D40AD06D0A431B948C2AD7
SHA-512:	C9476FD51E5FFCFE537C510934966FE69F8DEEE18641F6AAA9EB6C8DDAD29470FFCA8B85086F4D0D2860B89D54574386C1A9D6245196ABB4DA5A26E749E5C45D
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....[...Y,......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IaY.c....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VaY c....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VaY c....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VaY c...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VaY"c...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............B.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 1 11:25:02 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9953266730916392
Encrypted:	false
SSDEEP:	48:8/1dmTX7skH9idAKZdA10eh/iZUkAQkqehOy+2:8/usw9Qny
MD5:	1545479B5CF40577CE5B1365439F386B
SHA1:	17933B2C206E09A61E289E0762D81794A0CDA0DF
SHA-256:	13251E26249C806678B50D496B6C0CA77AA4346E9C78144DDAC32868FD7954F7
SHA-512:	F112FF1D9CF6E010F92AA3FCE531937F024BE0BFCEDA4328CBEAF83D11C522C890AA17A53B5EB05CC6918B9174193F127E9B6F1448C8A9DDE7D468519E4CC530
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......Y,......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IaY.c....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VaY c....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VaY c....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VaY c...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VaY"c...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............B.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.0049046804968444
Encrypted:	false
SSDEEP:	48:8e1dmTX7sjH9idAKZdA14tIeh7sFiZUkmgqeh7scy+BX:8eusFnay
MD5:	9596575D2D592401D05666455407DBA1
SHA1:	84F8DABAD3A322378DEDE922A32715F564CE6215
SHA-256:	2ADF6457284A5BDD6042EF1DE9B48F18A0EC4FCC8589AE7A45E1B1D53BCF38F8
SHA-512:	1908137DBB848D918DC7336DA326A701D824DCAC57D9FDCCCE9B1E7369CFDF78460BAB77A4BC6C9837CABE425B170C388F79E27F8B147619E36DF14FB352905E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IaY.c....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VaY c....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VaY c....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VaY c...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............B.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 1 11:25:02 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9907316677761964
Encrypted:	false
SSDEEP:	48:8S1dmTX7skH9idAKZdA1behDiZUkwqehCy+R:8SusrEy
MD5:	44FE10BAD6EA69D1AED5E0423DFE22CC
SHA1:	99168D802AABCDEA36F2DE20E512B5FA8FF503C2
SHA-256:	C1FDA0E0B805586B7EB9C65778162C044D32C296DD6C829656616FFB63D0A32D
SHA-512:	3CC14AB443E1927E63331D318DE3EA2EDD370802D532C9B45E8B4E262B9571CE22C7058417C929AC3B6A81D4FFDCF5CECE3F14EA962B7748C7E82517F51C6D74
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....F\..Y,......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IaY.c....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VaY c....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VaY c....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VaY c...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VaY"c...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............B.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 1 11:25:02 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.981207221172885
Encrypted:	false
SSDEEP:	48:8o1dmTX7skH9idAKZdA1VehBiZUk1W1qehoy+C:8ousr9Iy
MD5:	E4E4C9C8A769112D9EBFFA7C038D3172
SHA1:	66C3C0250CC23E8BEB218F95DA267D960B7AB1E2
SHA-256:	EDDEAA4F956B0B71A124728E9CAEB906EF6F6D050CE2107F8726181807E17315
SHA-512:	F9601EE969C01DA14659BE92BD9A319299D4474A77D385DCB9CA356097A77EE9CF6B5F6EF65CCDB55CEE997E0E74AC143408A255B61D8B69777BCFFD78473323
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....Zj..Y,......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IaY.c....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VaY c....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VaY c....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VaY c...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VaY"c...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............B.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 1 11:25:02 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9918258728794083
Encrypted:	false
SSDEEP:	48:8Q1dmTX7skH9idAKZdA1duT6ehOuTbbiZUk5OjqehOuTbay+yT+:8Qus3TTTbxWOvTbay7T
MD5:	95F6263A9C004E79E355F3E0C8CF5104
SHA1:	AE408E878256C8580F7CCFCE6036D53098DBDA3C
SHA-256:	B2621E691CA06C0D50087E3B87371577DFE4B771FB6AF53B7F5D761D16A80994
SHA-512:	37AEBEFC924AD79A5A59D43ECEA98E09129B6643A1C5AA29D8C1DE229EA72B92CFD76DAFE4407225625DF0F6AD6358B3D860EBA50D9BF364E7C509761A4D2619
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......{.Y,......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IaY.c....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VaY c....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VaY c....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VaY c...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VaY"c...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............B.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	520666
Entropy (8bit):	4.9111509293709394
Encrypted:	false
SSDEEP:	6144:T67LSEmIcJS2uIt7g2LFKfVf3GNRXPS5xuCf3GNRXPX1f3GNRXP28jIZM5c3aWkb:T6PrQQur8j8jg2To
MD5:	F04B951DBBD5C84B795C21ACD895D722
SHA1:	5D21EE054DA453B3040EA80B107E0C407D843068
SHA-256:	5B91C19B3B5AB6F40FD8FDE2194B985C066C11E9E972E8C3F444008B4A7D9440
SHA-512:	6AA0F3F1861B0A33BFB5B2D651E9402AE6747247741ABCB12A6AE8DCDF01B02FC539D203B68E01F6F144AF0D08F37BABF9FAAD9A25BD453C6571D2EB2524A41A
Malicious:	false
Reputation:	low
URL:	https://chrome-devtools-frontend.appspot.com/serve_file/@e3344ddefa12e60436fa28c81cf207c1afb4d0a9/third_party/vscode.web-custom-data/browsers.css-data.json
Preview:	{"version":1.1,"properties":[{"name":"additive-symbols","browsers":["FF33"],"syntax":"[ <integer> && <symbol> ]#","relevance":50,"description":"@counter-style descriptor. Specifies the symbols used by the marker-construction algorithm specified by the system descriptor. Needs to be specified if the counter system is 'additive'.","restrictions":["integer","string","image","identifier"]},{"name":"align-content","browsers":["E12","FF28","S9","C29","IE11","O16"],"values":[{"name":"center","description":"Lines are packed toward the center of the flex container."},{"name":"flex-end","description":"Lines are packed toward the end of the flex container."},{"name":"flex-start","description":"Lines are packed toward the start of the flex container."},{"name":"space-around","description":"Lines are evenly distributed in the flex container, with half-size spaces on either end."},{"name":"space-between","description":"Lines are evenly distributed in the flex container."},{"name":"stretch","descript

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1245
Entropy (8bit):	5.462849750105637
Encrypted:	false
SSDEEP:	24:hM0mIAvy4Wvsqs1Ra7JZRGNeHX+AYcvP2wk1RjdEF3qpMk5:lmIAq1UqsziJZ+eHX+AdP2TvpMk5
MD5:	5343C1A8B203C162A3BF3870D9F50FD4
SHA1:	04B5B886C20D88B57EEA6D8FF882624A4AC1E51D
SHA-256:	DC1D54DAB6EC8C00F70137927504E4F222C8395F10760B6BEECFCFA94E08249F
SHA-512:	E0F50ACB6061744E825A4051765CEBF23E8C489B55B190739409D8A79BB08DAC8F919247A4E5F65A015EA9C57D326BBEF7EA045163915129E01F316C4958D949
Malicious:	false
Reputation:	low
URL:	https://japaneastr-notifyp.svc.ms/favicon.ico
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">.. ..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="co

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	low
URL:	https://japaneastr-notifyp.svc.ms/
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-01T13:25:11.358648+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.17	49706	TCP
2024-11-01T13:25:49.997928+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.17	49728	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 13:24:59.209352970 CET	49677	443	192.168.2.17	204.79.197.200
Nov 1, 2024 13:24:59.209357023 CET	49678	443	192.168.2.17	204.79.197.200
Nov 1, 2024 13:24:59.209393978 CET	49676	443	192.168.2.17	204.79.197.200
Nov 1, 2024 13:25:02.259676933 CET	49700	80	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:02.259805918 CET	49701	80	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:02.262208939 CET	49702	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:02.262233019 CET	443	49702	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:02.262301922 CET	49702	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:02.262479067 CET	49702	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:02.262489080 CET	443	49702	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:02.264499903 CET	80	49700	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:02.264573097 CET	49700	80	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:02.264683008 CET	80	49701	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:02.264745951 CET	49701	80	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:02.988084078 CET	443	49702	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:02.988428116 CET	49702	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:02.988445997 CET	443	49702	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:02.989509106 CET	443	49702	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:02.989583969 CET	49702	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:03.001224995 CET	49702	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:03.001296043 CET	443	49702	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:03.001456022 CET	49702	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:03.001466036 CET	443	49702	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:03.047698975 CET	49702	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:03.699120045 CET	443	49702	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:03.700265884 CET	443	49702	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:03.700355053 CET	49702	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:03.701100111 CET	49702	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:03.701118946 CET	443	49702	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:03.765701056 CET	49704	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:03.765757084 CET	443	49704	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:03.765813112 CET	49704	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:03.766457081 CET	49704	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:03.766472101 CET	443	49704	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:04.517224073 CET	443	49704	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:04.517662048 CET	49704	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:04.517683983 CET	443	49704	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:04.518170118 CET	443	49704	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:04.518481970 CET	49704	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:04.518554926 CET	443	49704	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:04.518616915 CET	49704	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:04.563324928 CET	443	49704	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:05.208596945 CET	443	49704	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:05.210298061 CET	443	49704	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:05.210402966 CET	49704	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:05.210815907 CET	49704	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:05.210839033 CET	443	49704	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:06.179332018 CET	49705	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:06.179388046 CET	443	49705	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:06.179474115 CET	49705	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:06.179733038 CET	49705	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:06.179740906 CET	443	49705	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:07.043989897 CET	443	49705	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:07.044389963 CET	49705	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:07.044421911 CET	443	49705	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:07.045842886 CET	443	49705	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:07.045917034 CET	49705	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:07.047005892 CET	49705	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:07.047097921 CET	443	49705	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:07.094445944 CET	49705	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:07.094484091 CET	443	49705	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:07.142364025 CET	49705	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:09.284667015 CET	49706	443	192.168.2.17	20.12.23.50
Nov 1, 2024 13:25:09.284703016 CET	443	49706	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:09.284771919 CET	49706	443	192.168.2.17	20.12.23.50
Nov 1, 2024 13:25:09.286319017 CET	49706	443	192.168.2.17	20.12.23.50
Nov 1, 2024 13:25:09.286334038 CET	443	49706	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:10.154027939 CET	443	49706	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:10.154149055 CET	49706	443	192.168.2.17	20.12.23.50
Nov 1, 2024 13:25:10.156330109 CET	49706	443	192.168.2.17	20.12.23.50
Nov 1, 2024 13:25:10.156347036 CET	443	49706	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:10.156558990 CET	443	49706	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:10.209382057 CET	49706	443	192.168.2.17	20.12.23.50
Nov 1, 2024 13:25:11.071240902 CET	49706	443	192.168.2.17	20.12.23.50
Nov 1, 2024 13:25:11.115345001 CET	443	49706	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:11.357686043 CET	443	49706	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:11.357708931 CET	443	49706	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:11.357716084 CET	443	49706	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:11.357741117 CET	443	49706	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:11.357753992 CET	443	49706	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:11.357764006 CET	443	49706	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:11.357770920 CET	49706	443	192.168.2.17	20.12.23.50
Nov 1, 2024 13:25:11.357779026 CET	443	49706	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:11.357851028 CET	49706	443	192.168.2.17	20.12.23.50
Nov 1, 2024 13:25:11.357851028 CET	49706	443	192.168.2.17	20.12.23.50
Nov 1, 2024 13:25:11.357909918 CET	443	49706	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:11.358549118 CET	443	49706	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:11.358597040 CET	49706	443	192.168.2.17	20.12.23.50
Nov 1, 2024 13:25:11.361309052 CET	49706	443	192.168.2.17	20.12.23.50
Nov 1, 2024 13:25:12.251156092 CET	49706	443	192.168.2.17	20.12.23.50
Nov 1, 2024 13:25:12.251177073 CET	443	49706	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:12.251285076 CET	49706	443	192.168.2.17	20.12.23.50
Nov 1, 2024 13:25:12.251291990 CET	443	49706	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:13.159785986 CET	49675	443	192.168.2.17	204.79.197.203
Nov 1, 2024 13:25:13.462635040 CET	49675	443	192.168.2.17	204.79.197.203
Nov 1, 2024 13:25:14.073082924 CET	49675	443	192.168.2.17	204.79.197.203
Nov 1, 2024 13:25:15.282429934 CET	49675	443	192.168.2.17	204.79.197.203
Nov 1, 2024 13:25:15.300870895 CET	49714	443	192.168.2.17	184.28.90.27
Nov 1, 2024 13:25:15.300903082 CET	443	49714	184.28.90.27	192.168.2.17
Nov 1, 2024 13:25:15.300997019 CET	49714	443	192.168.2.17	184.28.90.27
Nov 1, 2024 13:25:15.301878929 CET	49714	443	192.168.2.17	184.28.90.27
Nov 1, 2024 13:25:15.301892996 CET	443	49714	184.28.90.27	192.168.2.17
Nov 1, 2024 13:25:16.157718897 CET	443	49714	184.28.90.27	192.168.2.17
Nov 1, 2024 13:25:16.157799959 CET	49714	443	192.168.2.17	184.28.90.27
Nov 1, 2024 13:25:16.160846949 CET	49714	443	192.168.2.17	184.28.90.27
Nov 1, 2024 13:25:16.160857916 CET	443	49714	184.28.90.27	192.168.2.17
Nov 1, 2024 13:25:16.161066055 CET	443	49714	184.28.90.27	192.168.2.17
Nov 1, 2024 13:25:16.198498011 CET	49714	443	192.168.2.17	184.28.90.27
Nov 1, 2024 13:25:16.239377022 CET	443	49714	184.28.90.27	192.168.2.17
Nov 1, 2024 13:25:16.442826986 CET	443	49714	184.28.90.27	192.168.2.17
Nov 1, 2024 13:25:16.442903042 CET	443	49714	184.28.90.27	192.168.2.17
Nov 1, 2024 13:25:16.443025112 CET	49714	443	192.168.2.17	184.28.90.27
Nov 1, 2024 13:25:16.443054914 CET	443	49714	184.28.90.27	192.168.2.17
Nov 1, 2024 13:25:16.443067074 CET	49714	443	192.168.2.17	184.28.90.27
Nov 1, 2024 13:25:16.443067074 CET	49714	443	192.168.2.17	184.28.90.27
Nov 1, 2024 13:25:16.443077087 CET	443	49714	184.28.90.27	192.168.2.17
Nov 1, 2024 13:25:16.443083048 CET	443	49714	184.28.90.27	192.168.2.17
Nov 1, 2024 13:25:16.484821081 CET	49715	443	192.168.2.17	184.28.90.27
Nov 1, 2024 13:25:16.484878063 CET	443	49715	184.28.90.27	192.168.2.17
Nov 1, 2024 13:25:16.484952927 CET	49715	443	192.168.2.17	184.28.90.27
Nov 1, 2024 13:25:16.485205889 CET	49715	443	192.168.2.17	184.28.90.27
Nov 1, 2024 13:25:16.485223055 CET	443	49715	184.28.90.27	192.168.2.17
Nov 1, 2024 13:25:17.034727097 CET	443	49705	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:17.034804106 CET	443	49705	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:17.035073042 CET	49705	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:17.315675974 CET	443	49715	184.28.90.27	192.168.2.17
Nov 1, 2024 13:25:17.315748930 CET	49715	443	192.168.2.17	184.28.90.27
Nov 1, 2024 13:25:17.316852093 CET	49715	443	192.168.2.17	184.28.90.27
Nov 1, 2024 13:25:17.316862106 CET	443	49715	184.28.90.27	192.168.2.17
Nov 1, 2024 13:25:17.317053080 CET	443	49715	184.28.90.27	192.168.2.17
Nov 1, 2024 13:25:17.319973946 CET	49715	443	192.168.2.17	184.28.90.27
Nov 1, 2024 13:25:17.328716040 CET	49680	443	192.168.2.17	20.189.173.13
Nov 1, 2024 13:25:17.367324114 CET	443	49715	184.28.90.27	192.168.2.17
Nov 1, 2024 13:25:17.561748028 CET	443	49715	184.28.90.27	192.168.2.17
Nov 1, 2024 13:25:17.561803102 CET	443	49715	184.28.90.27	192.168.2.17
Nov 1, 2024 13:25:17.561956882 CET	49715	443	192.168.2.17	184.28.90.27
Nov 1, 2024 13:25:17.562601089 CET	49715	443	192.168.2.17	184.28.90.27
Nov 1, 2024 13:25:17.562621117 CET	443	49715	184.28.90.27	192.168.2.17
Nov 1, 2024 13:25:17.562643051 CET	49715	443	192.168.2.17	184.28.90.27
Nov 1, 2024 13:25:17.562648058 CET	443	49715	184.28.90.27	192.168.2.17
Nov 1, 2024 13:25:17.630563974 CET	49680	443	192.168.2.17	20.189.173.13
Nov 1, 2024 13:25:17.631804943 CET	49705	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:17.631834030 CET	443	49705	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:17.694523096 CET	49675	443	192.168.2.17	204.79.197.203
Nov 1, 2024 13:25:18.236545086 CET	49680	443	192.168.2.17	20.189.173.13
Nov 1, 2024 13:25:19.445426941 CET	49680	443	192.168.2.17	20.189.173.13
Nov 1, 2024 13:25:21.859463930 CET	49680	443	192.168.2.17	20.189.173.13
Nov 1, 2024 13:25:22.498456001 CET	49675	443	192.168.2.17	204.79.197.203
Nov 1, 2024 13:25:25.780679941 CET	49682	80	192.168.2.17	192.229.211.108
Nov 1, 2024 13:25:26.084579945 CET	49682	80	192.168.2.17	192.229.211.108
Nov 1, 2024 13:25:26.660546064 CET	49680	443	192.168.2.17	20.189.173.13
Nov 1, 2024 13:25:26.691536903 CET	49682	80	192.168.2.17	192.229.211.108
Nov 1, 2024 13:25:27.903480053 CET	49682	80	192.168.2.17	192.229.211.108
Nov 1, 2024 13:25:30.310519934 CET	49682	80	192.168.2.17	192.229.211.108
Nov 1, 2024 13:25:31.259921074 CET	49716	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:31.259963036 CET	443	49716	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:31.260035992 CET	49716	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:31.260291100 CET	49716	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:31.260302067 CET	443	49716	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:32.113477945 CET	49675	443	192.168.2.17	204.79.197.203
Nov 1, 2024 13:25:32.114641905 CET	443	49716	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:32.114943027 CET	49716	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:32.114959002 CET	443	49716	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:32.116075993 CET	443	49716	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:32.116374016 CET	49716	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:32.116501093 CET	49716	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:32.116504908 CET	443	49716	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:32.116544962 CET	443	49716	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:32.161485910 CET	49716	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:32.396049023 CET	443	49716	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:32.396179914 CET	443	49716	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:32.396243095 CET	49716	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:32.396265984 CET	443	49716	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:32.449469090 CET	49716	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:32.449489117 CET	443	49716	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:32.449595928 CET	49716	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:32.449732065 CET	443	49716	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:32.449812889 CET	49716	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:35.111512899 CET	49682	80	192.168.2.17	192.229.211.108
Nov 1, 2024 13:25:36.275712013 CET	49680	443	192.168.2.17	20.189.173.13
Nov 1, 2024 13:25:36.282174110 CET	49691	443	192.168.2.17	204.79.197.200
Nov 1, 2024 13:25:36.287936926 CET	443	49691	204.79.197.200	192.168.2.17
Nov 1, 2024 13:25:36.288029909 CET	49691	443	192.168.2.17	204.79.197.200
Nov 1, 2024 13:25:36.547262907 CET	49717	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:36.547338963 CET	443	49717	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:36.547405005 CET	49717	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:36.547805071 CET	49718	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:36.547842026 CET	443	49718	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:36.547903061 CET	49718	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:36.548007011 CET	49717	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:36.548026085 CET	443	49717	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:36.548333883 CET	49718	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:36.548346043 CET	443	49718	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:36.855619907 CET	49719	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:36.855662107 CET	443	49719	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:36.855736971 CET	49719	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:36.856990099 CET	49719	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:36.857012987 CET	443	49719	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:37.265312910 CET	49720	443	192.168.2.17	13.107.5.88
Nov 1, 2024 13:25:37.265345097 CET	443	49720	13.107.5.88	192.168.2.17
Nov 1, 2024 13:25:37.265436888 CET	49720	443	192.168.2.17	13.107.5.88
Nov 1, 2024 13:25:37.294459105 CET	443	49717	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:37.294785023 CET	49717	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:37.294809103 CET	443	49717	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:37.295284033 CET	443	49717	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:37.295671940 CET	49717	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:37.295758963 CET	443	49717	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:37.295840025 CET	49717	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:37.300331116 CET	49720	443	192.168.2.17	13.107.5.88
Nov 1, 2024 13:25:37.300344944 CET	443	49720	13.107.5.88	192.168.2.17
Nov 1, 2024 13:25:37.310347080 CET	443	49718	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:37.310663939 CET	49718	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:37.310686111 CET	443	49718	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:37.310975075 CET	443	49718	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:37.311413050 CET	49718	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:37.311475992 CET	443	49718	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:37.343333006 CET	443	49717	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:37.354515076 CET	49718	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:37.973208904 CET	443	49719	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:37.973329067 CET	49719	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:37.992484093 CET	443	49717	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:37.995646000 CET	443	49717	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:37.996957064 CET	49717	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:37.997942924 CET	49717	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:37.997981071 CET	443	49717	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:38.030498028 CET	49719	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:38.030529022 CET	443	49719	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:38.030746937 CET	443	49719	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:38.032459974 CET	49719	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:38.032543898 CET	49719	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:38.032571077 CET	443	49719	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:38.041747093 CET	443	49720	13.107.5.88	192.168.2.17
Nov 1, 2024 13:25:38.041867018 CET	49720	443	192.168.2.17	13.107.5.88
Nov 1, 2024 13:25:38.045640945 CET	49720	443	192.168.2.17	13.107.5.88
Nov 1, 2024 13:25:38.045649052 CET	443	49720	13.107.5.88	192.168.2.17
Nov 1, 2024 13:25:38.045906067 CET	443	49720	13.107.5.88	192.168.2.17
Nov 1, 2024 13:25:38.086543083 CET	49720	443	192.168.2.17	13.107.5.88
Nov 1, 2024 13:25:38.089886904 CET	49720	443	192.168.2.17	13.107.5.88
Nov 1, 2024 13:25:38.131340027 CET	443	49720	13.107.5.88	192.168.2.17
Nov 1, 2024 13:25:38.215977907 CET	443	49720	13.107.5.88	192.168.2.17
Nov 1, 2024 13:25:38.217703104 CET	443	49720	13.107.5.88	192.168.2.17
Nov 1, 2024 13:25:38.217782021 CET	49720	443	192.168.2.17	13.107.5.88
Nov 1, 2024 13:25:38.220303059 CET	49720	443	192.168.2.17	13.107.5.88
Nov 1, 2024 13:25:38.474756002 CET	443	49719	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:38.474777937 CET	443	49719	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:38.474811077 CET	443	49719	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:38.474862099 CET	49719	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:38.474919081 CET	443	49719	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:38.474965096 CET	49719	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:38.475599051 CET	49719	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:38.475634098 CET	49719	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:38.475748062 CET	443	49719	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:38.475776911 CET	443	49719	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:38.475831985 CET	49719	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:38.585002899 CET	49721	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:38.585035086 CET	443	49721	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:38.585129023 CET	49721	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:38.585341930 CET	49721	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:38.585350037 CET	443	49721	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:39.745367050 CET	443	49721	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:39.746022940 CET	49721	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:39.746059895 CET	443	49721	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:39.746974945 CET	49721	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:39.746979952 CET	443	49721	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:39.747035980 CET	49721	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:39.747044086 CET	443	49721	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:40.168679953 CET	443	49721	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:40.168708086 CET	443	49721	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:40.168752909 CET	443	49721	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:40.168832064 CET	49721	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:40.168844938 CET	443	49721	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:40.168915987 CET	49721	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:40.169403076 CET	49721	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:40.169408083 CET	443	49721	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:40.169564009 CET	443	49721	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:40.169573069 CET	49721	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:40.169604063 CET	443	49721	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:40.169764042 CET	49721	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:40.264127016 CET	49722	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:40.264156103 CET	443	49722	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:40.264256954 CET	49722	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:40.264421940 CET	49722	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:40.264431953 CET	443	49722	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:41.381171942 CET	443	49722	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:41.381722927 CET	49722	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:41.381747961 CET	443	49722	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:41.382646084 CET	49722	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:41.382652044 CET	443	49722	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:41.382703066 CET	49722	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:41.382710934 CET	443	49722	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:41.803451061 CET	443	49722	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:41.803483963 CET	443	49722	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:41.803509951 CET	443	49722	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:41.803579092 CET	49722	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:41.803579092 CET	49722	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:41.803595066 CET	443	49722	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:41.804023981 CET	49722	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:41.804032087 CET	443	49722	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:41.804063082 CET	49722	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:41.804181099 CET	443	49722	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:41.804219007 CET	443	49722	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:41.805232048 CET	49722	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:41.851051092 CET	49723	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:41.851083040 CET	443	49723	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:41.851255894 CET	49723	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:41.851838112 CET	49723	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:41.851850033 CET	443	49723	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:43.983089924 CET	443	49723	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:43.987041950 CET	49723	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:43.987063885 CET	443	49723	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:43.988029957 CET	49723	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:43.988029957 CET	49723	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:43.988039017 CET	443	49723	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:43.988053083 CET	443	49723	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:44.388998032 CET	443	49723	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:44.389027119 CET	443	49723	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:44.389075041 CET	443	49723	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:44.389113903 CET	49723	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:44.389123917 CET	443	49723	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:44.389151096 CET	49723	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:44.389487028 CET	49723	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:44.389497042 CET	443	49723	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:44.389528036 CET	49723	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:44.389637947 CET	443	49723	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:44.389672041 CET	443	49723	20.190.160.14	192.168.2.17
Nov 1, 2024 13:25:44.390125990 CET	49723	443	192.168.2.17	20.190.160.14
Nov 1, 2024 13:25:44.493896961 CET	49724	443	192.168.2.17	92.123.104.21
Nov 1, 2024 13:25:44.493925095 CET	443	49724	92.123.104.21	192.168.2.17
Nov 1, 2024 13:25:44.493995905 CET	49724	443	192.168.2.17	92.123.104.21
Nov 1, 2024 13:25:44.496150017 CET	49724	443	192.168.2.17	92.123.104.21
Nov 1, 2024 13:25:44.496160984 CET	443	49724	92.123.104.21	192.168.2.17
Nov 1, 2024 13:25:44.718564034 CET	49682	80	192.168.2.17	192.229.211.108
Nov 1, 2024 13:25:45.438003063 CET	443	49724	92.123.104.21	192.168.2.17
Nov 1, 2024 13:25:45.438092947 CET	49724	443	192.168.2.17	92.123.104.21
Nov 1, 2024 13:25:45.490087032 CET	49724	443	192.168.2.17	92.123.104.21
Nov 1, 2024 13:25:45.490087032 CET	49724	443	192.168.2.17	92.123.104.21
Nov 1, 2024 13:25:45.490103960 CET	443	49724	92.123.104.21	192.168.2.17
Nov 1, 2024 13:25:45.490114927 CET	443	49724	92.123.104.21	192.168.2.17
Nov 1, 2024 13:25:45.490434885 CET	443	49724	92.123.104.21	192.168.2.17
Nov 1, 2024 13:25:45.490523100 CET	49724	443	192.168.2.17	92.123.104.21
Nov 1, 2024 13:25:45.778759956 CET	443	49724	92.123.104.21	192.168.2.17
Nov 1, 2024 13:25:45.778959036 CET	443	49724	92.123.104.21	192.168.2.17
Nov 1, 2024 13:25:45.779270887 CET	49724	443	192.168.2.17	92.123.104.21
Nov 1, 2024 13:25:45.779284000 CET	443	49724	92.123.104.21	192.168.2.17
Nov 1, 2024 13:25:45.779478073 CET	49724	443	192.168.2.17	92.123.104.21
Nov 1, 2024 13:25:45.781991959 CET	49724	443	192.168.2.17	92.123.104.21
Nov 1, 2024 13:25:45.782006025 CET	443	49724	92.123.104.21	192.168.2.17
Nov 1, 2024 13:25:45.782037020 CET	49724	443	192.168.2.17	92.123.104.21
Nov 1, 2024 13:25:45.782102108 CET	49724	443	192.168.2.17	92.123.104.21
Nov 1, 2024 13:25:47.272562027 CET	49700	80	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:47.272614956 CET	49701	80	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:47.277733088 CET	80	49700	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:47.277754068 CET	80	49701	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:48.474328995 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:48.474361897 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:48.474440098 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:48.474682093 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:48.474694014 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:48.802762032 CET	49728	443	192.168.2.17	20.12.23.50
Nov 1, 2024 13:25:48.802828074 CET	443	49728	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:48.802956104 CET	49728	443	192.168.2.17	20.12.23.50
Nov 1, 2024 13:25:48.803261995 CET	49728	443	192.168.2.17	20.12.23.50
Nov 1, 2024 13:25:48.803282976 CET	443	49728	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:49.344680071 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:49.345026016 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:49.345041037 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:49.346678972 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:49.346894979 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:49.346901894 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:49.346949100 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:49.350795031 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:49.350892067 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:49.350980043 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:49.350985050 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:49.400731087 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:49.691895962 CET	443	49728	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:49.692014933 CET	49728	443	192.168.2.17	20.12.23.50
Nov 1, 2024 13:25:49.694057941 CET	49728	443	192.168.2.17	20.12.23.50
Nov 1, 2024 13:25:49.694068909 CET	443	49728	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:49.694277048 CET	443	49728	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:49.700993061 CET	49728	443	192.168.2.17	20.12.23.50
Nov 1, 2024 13:25:49.747343063 CET	443	49728	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:49.995858908 CET	443	49728	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:49.995882034 CET	443	49728	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:49.995894909 CET	443	49728	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:49.995980978 CET	49728	443	192.168.2.17	20.12.23.50
Nov 1, 2024 13:25:49.996001005 CET	443	49728	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:49.996056080 CET	49728	443	192.168.2.17	20.12.23.50
Nov 1, 2024 13:25:49.997790098 CET	443	49728	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:49.997833014 CET	443	49728	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:49.997855902 CET	443	49728	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:49.997860909 CET	49728	443	192.168.2.17	20.12.23.50
Nov 1, 2024 13:25:49.997896910 CET	49728	443	192.168.2.17	20.12.23.50
Nov 1, 2024 13:25:49.997922897 CET	49728	443	192.168.2.17	20.12.23.50
Nov 1, 2024 13:25:49.998764992 CET	49728	443	192.168.2.17	20.12.23.50
Nov 1, 2024 13:25:49.998781919 CET	443	49728	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:49.998794079 CET	49728	443	192.168.2.17	20.12.23.50
Nov 1, 2024 13:25:49.998800039 CET	443	49728	20.12.23.50	192.168.2.17
Nov 1, 2024 13:25:50.003562927 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.003736973 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.003807068 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.003818989 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.003846884 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.003896952 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.003954887 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.012182951 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.012248993 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.012254000 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.012276888 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.012320995 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.021306038 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.066577911 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.066590071 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.114583015 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.120337963 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.120405912 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.120436907 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.120456934 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.120464087 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.120518923 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.127480984 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.131912947 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.131938934 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.131963968 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.131972075 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.132014990 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.141015053 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.149960041 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.150007963 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.150024891 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.150029898 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.150084019 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.158993006 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.168123960 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.168174982 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.168188095 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.168191910 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.168248892 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.177289963 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.186157942 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.186213970 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.186218977 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.237078905 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.237147093 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.237164974 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.237251997 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.237308979 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.237313986 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.237459898 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.237525940 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.237530947 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.238080978 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.238157034 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.238161087 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.244631052 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.244690895 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.244697094 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.244997978 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.245033026 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.245059967 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.245064020 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.245105982 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.252140999 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.255712032 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.255743980 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.255762100 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.255765915 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.255815029 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.269948959 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.270025015 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.270057917 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.270082951 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.270087957 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.270123959 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.273479939 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.279359102 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.279392958 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.279419899 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.279428005 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.279483080 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.285273075 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.291156054 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.291196108 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.291219950 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.291224957 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.291270971 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.296930075 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.302700996 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.302762985 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.302767992 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.315071106 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.315160036 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.315175056 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.318106890 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.318166971 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.318177938 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.324016094 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.324103117 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.324110985 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.329792023 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.329862118 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.329866886 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.353790998 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.353842020 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.353869915 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.353876114 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.353912115 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.353926897 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.353931904 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.353974104 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.354532957 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.354598045 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.354646921 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.354650974 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.361767054 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.361835957 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.361840010 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.364834070 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.364890099 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.364896059 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.369339943 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.369419098 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.369425058 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.374495983 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.374589920 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.374596119 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.379201889 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.379264116 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.379270077 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.384058952 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.384124041 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.384130001 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.388946056 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.389019966 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.389025927 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.392888069 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.392968893 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.392975092 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.395333052 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.395390987 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.395396948 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.397888899 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.397943974 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.397949934 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.400975943 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.401052952 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.401061058 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.404040098 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.404139996 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.404145956 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.407124043 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.407201052 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.407207012 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.410275936 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.410342932 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.410348892 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.413161993 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.413232088 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.413238049 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.416011095 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.416085958 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.416091919 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.419114113 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.419194937 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.419200897 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.421989918 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.422065020 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.422069073 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.424906015 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.424973011 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.424978971 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.427867889 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.427937984 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.427944899 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.430509090 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.430576086 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.430582047 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.433454037 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.433552980 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.433559895 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.436041117 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.436125994 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.436134100 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.438806057 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.438874960 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.438883066 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.441517115 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.441585064 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.441591978 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.444359064 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.444421053 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.444431067 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.447105885 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.447171926 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.447180033 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.449774027 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.449832916 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.449839115 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.452663898 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.452888012 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.452897072 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.455440998 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.455511093 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.455522060 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.458218098 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.458285093 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.458300114 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.460855961 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.460922003 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.460932970 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.463452101 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.463524103 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.463536024 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.466317892 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.466388941 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.466399908 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.469007015 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.469069958 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.469079971 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.471278906 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.471340895 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.471349001 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.473908901 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.473967075 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.473974943 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.476784945 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.476841927 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.476850986 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.479063988 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.479137897 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.479144096 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.481631041 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.481698990 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.481704950 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.484014034 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.484071016 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.484077930 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.486602068 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.486660004 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.486670971 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.489186049 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.489239931 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.489247084 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.491594076 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.491657019 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.491663933 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.493870974 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.493952036 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.493957043 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.496484995 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.496562004 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.496567965 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.499672890 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.499727964 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.499735117 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.501058102 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.501117945 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.501125097 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.503283978 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.503348112 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.503354073 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.505553007 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.505614042 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.505620003 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.508519888 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.508595943 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.508604050 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.510251999 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.510318041 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.510324955 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.512470961 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.512582064 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.512588978 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.514596939 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.514662981 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.514669895 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.516855001 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.516917944 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.516927958 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.519042969 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.519105911 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.519114971 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.522151947 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.522216082 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.522226095 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.523137093 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.523199081 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.523205996 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.525234938 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.525298119 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.525305033 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.527087927 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.527152061 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.527158976 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.529200077 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.529272079 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.529279947 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.531250000 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.531310081 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.531321049 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.533013105 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.533073902 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.533081055 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.534971952 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.535039902 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.535047054 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.536818027 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.536880970 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.536889076 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.538820028 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.538882017 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.538888931 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.540889025 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.540960073 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.540966988 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.542552948 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.542629957 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.542637110 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.544179916 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.544240952 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.544244051 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.544258118 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.544320107 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.546643972 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.547760010 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.547801971 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.547816038 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.547825098 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.547867060 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.549510002 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.551413059 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.551471949 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.551479101 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.553121090 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.553173065 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.553183079 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.553193092 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.553241968 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.554968119 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.556468010 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.556533098 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.556540012 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.558135986 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.558197021 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.558202982 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.559916019 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.559978008 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.559984922 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.561557055 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.561593056 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.561626911 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.561635971 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.561680079 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.563291073 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.564656973 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.564747095 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.564755917 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.566106081 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.566168070 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.566175938 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.567676067 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.567745924 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.567751884 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.569324970 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.569406033 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.569411993 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.570749998 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.570820093 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.570827007 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.572474003 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.572561026 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.572563887 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.572583914 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.572628021 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.573753119 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.575274944 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.575346947 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.575356007 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.576725960 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.576788902 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.576797962 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.579972029 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.580049038 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.580056906 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.580142975 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.580193043 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.580199957 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.581119061 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.581182957 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.581188917 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.582684040 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.582753897 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.582761049 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.583760023 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.583826065 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.583832979 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.585501909 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.585568905 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.585577011 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.586637974 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.586700916 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.586708069 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.587676048 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.587738037 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.587744951 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.589385033 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.589452028 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.589458942 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.590697050 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.590763092 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.590773106 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.591778040 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.591842890 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.591844082 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.591855049 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.591893911 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.592991114 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.594204903 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.594249964 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.594264984 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.594274044 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.594331026 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.595623016 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.598540068 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.598594904 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.598602057 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.598613977 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.598670006 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.598678112 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.599528074 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.599570036 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.599586010 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.599592924 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.599632025 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.600703001 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.602139950 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.602200031 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.602207899 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.603996038 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.604053020 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.604058981 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.604868889 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.604935884 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.604938030 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.604955912 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.604998112 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.605021954 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.605788946 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.605856895 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.605866909 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.610281944 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.610357046 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.610371113 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.611498117 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.611562967 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.611572981 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.612536907 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.612601042 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.612608910 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.613886118 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.613998890 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.614006042 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.614651918 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.614713907 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.614718914 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.616292953 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.616344929 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.616352081 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.616725922 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.616795063 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.616801023 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.617842913 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.618045092 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.618052959 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.619585037 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.619664907 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.619672060 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.620273113 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.620354891 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.620362997 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.621825933 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.621880054 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.621886969 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.621980906 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.622034073 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.622041941 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.624161959 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.624234915 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.624242067 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.625181913 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.625241041 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.625247955 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.626167059 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.626235008 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.626245022 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.627530098 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.627599955 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.627609968 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.628345013 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.628401041 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.628407955 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.629704952 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.629784107 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.629791975 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.630414009 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.630471945 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.630479097 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.631733894 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.631791115 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.631797075 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.632615089 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.632667065 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.632673979 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.633882999 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.633951902 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.633960009 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.634248972 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.634301901 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.634311914 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.635245085 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.635298967 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.635309935 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.635792017 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.635847092 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.635854006 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.636872053 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.636928082 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.636935949 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.637917042 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.637975931 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.637983084 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.639215946 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.639273882 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.639281034 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.639955997 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.640013933 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.640021086 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.640698910 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.640755892 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.640760899 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.641978025 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.642031908 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.642039061 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.643959999 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.644013882 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.644021034 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.645042896 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.645100117 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.645106077 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.646066904 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.646130085 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.646136999 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.647267103 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.647335052 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.647342920 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.648010015 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.648073912 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.648081064 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.649142981 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.649199009 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.649204969 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.649977922 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.650043011 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.650049925 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.650779963 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.650844097 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.650852919 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.650876045 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.650924921 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.650970936 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.651515007 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.651568890 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.651575089 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.703562021 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.703574896 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.703830004 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:50.703931093 CET	443	49727	142.250.186.52	192.168.2.17
Nov 1, 2024 13:25:50.703990936 CET	49727	443	192.168.2.17	142.250.186.52
Nov 1, 2024 13:25:56.131372929 CET	49732	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:56.131437063 CET	443	49732	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:56.131584883 CET	49732	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:56.131892920 CET	49732	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:56.131905079 CET	443	49732	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:56.995007992 CET	443	49732	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:56.995337963 CET	49732	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:56.995356083 CET	443	49732	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:56.996812105 CET	443	49732	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:56.996903896 CET	49732	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:56.997186899 CET	49732	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:56.997267962 CET	443	49732	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:56.997311115 CET	49732	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:57.043338060 CET	443	49732	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:57.048619032 CET	49732	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:57.048629045 CET	443	49732	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:57.096615076 CET	49732	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:57.114240885 CET	49732	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:57.114334106 CET	443	49732	142.250.186.68	192.168.2.17
Nov 1, 2024 13:25:57.114408016 CET	49732	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:25:57.120198011 CET	49718	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:57.121840954 CET	49733	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:57.121866941 CET	443	49733	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:57.121959925 CET	49733	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:57.122227907 CET	49733	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:57.122236967 CET	443	49733	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:57.167334080 CET	443	49718	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:57.812710047 CET	443	49718	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:57.814687967 CET	443	49718	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:57.814768076 CET	49718	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:57.814971924 CET	49718	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:57.814985991 CET	443	49718	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:57.849109888 CET	443	49733	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:57.850423098 CET	49733	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:57.850440979 CET	443	49733	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:57.850969076 CET	443	49733	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:57.851485014 CET	49733	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:25:57.851577044 CET	443	49733	13.107.136.10	192.168.2.17
Nov 1, 2024 13:25:57.891623974 CET	49733	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:26:03.623101950 CET	49700	80	192.168.2.17	13.107.136.10
Nov 1, 2024 13:26:03.623158932 CET	49701	80	192.168.2.17	13.107.136.10
Nov 1, 2024 13:26:03.628741980 CET	80	49700	13.107.136.10	192.168.2.17
Nov 1, 2024 13:26:03.628757954 CET	80	49701	13.107.136.10	192.168.2.17
Nov 1, 2024 13:26:03.628824949 CET	49700	80	192.168.2.17	13.107.136.10
Nov 1, 2024 13:26:03.628845930 CET	49701	80	192.168.2.17	13.107.136.10
Nov 1, 2024 13:26:04.840883017 CET	49739	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:26:04.840919018 CET	443	49739	142.250.186.68	192.168.2.17
Nov 1, 2024 13:26:04.841021061 CET	49739	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:26:04.841372967 CET	49739	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:26:04.841383934 CET	443	49739	142.250.186.68	192.168.2.17
Nov 1, 2024 13:26:05.372473955 CET	49733	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:26:05.384299040 CET	49740	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:26:05.384330034 CET	443	49740	13.107.136.10	192.168.2.17
Nov 1, 2024 13:26:05.384391069 CET	49740	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:26:05.384604931 CET	49740	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:26:05.384619951 CET	443	49740	13.107.136.10	192.168.2.17
Nov 1, 2024 13:26:05.419328928 CET	443	49733	13.107.136.10	192.168.2.17
Nov 1, 2024 13:26:05.696769953 CET	443	49739	142.250.186.68	192.168.2.17
Nov 1, 2024 13:26:05.697045088 CET	49739	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:26:05.697062969 CET	443	49739	142.250.186.68	192.168.2.17
Nov 1, 2024 13:26:05.698389053 CET	443	49739	142.250.186.68	192.168.2.17
Nov 1, 2024 13:26:05.698481083 CET	49739	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:26:05.698761940 CET	49739	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:26:05.698812962 CET	443	49739	142.250.186.68	192.168.2.17
Nov 1, 2024 13:26:05.745659113 CET	49739	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:26:05.745666027 CET	443	49739	142.250.186.68	192.168.2.17
Nov 1, 2024 13:26:05.793652058 CET	49739	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:26:06.070583105 CET	443	49733	13.107.136.10	192.168.2.17
Nov 1, 2024 13:26:06.072038889 CET	443	49733	13.107.136.10	192.168.2.17
Nov 1, 2024 13:26:06.072144985 CET	49733	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:26:06.072653055 CET	49733	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:26:06.072669029 CET	443	49733	13.107.136.10	192.168.2.17
Nov 1, 2024 13:26:06.114059925 CET	443	49740	13.107.136.10	192.168.2.17
Nov 1, 2024 13:26:06.114583015 CET	49740	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:26:06.114598036 CET	443	49740	13.107.136.10	192.168.2.17
Nov 1, 2024 13:26:06.114900112 CET	443	49740	13.107.136.10	192.168.2.17
Nov 1, 2024 13:26:06.115266085 CET	49740	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:26:06.115325928 CET	443	49740	13.107.136.10	192.168.2.17
Nov 1, 2024 13:26:06.162955046 CET	49740	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:26:15.694591999 CET	443	49739	142.250.186.68	192.168.2.17
Nov 1, 2024 13:26:15.694647074 CET	443	49739	142.250.186.68	192.168.2.17
Nov 1, 2024 13:26:15.694715023 CET	49739	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:26:17.631807089 CET	49739	443	192.168.2.17	142.250.186.68
Nov 1, 2024 13:26:17.631829023 CET	443	49739	142.250.186.68	192.168.2.17
Nov 1, 2024 13:26:51.130966902 CET	49740	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:26:51.130989075 CET	443	49740	13.107.136.10	192.168.2.17
Nov 1, 2024 13:27:06.291579962 CET	49740	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:27:06.291671038 CET	443	49740	13.107.136.10	192.168.2.17
Nov 1, 2024 13:27:06.291762114 CET	49740	443	192.168.2.17	13.107.136.10
Nov 1, 2024 13:27:06.291866064 CET	49771	443	192.168.2.17	142.250.185.100
Nov 1, 2024 13:27:06.291941881 CET	443	49771	142.250.185.100	192.168.2.17
Nov 1, 2024 13:27:06.292032003 CET	49771	443	192.168.2.17	142.250.185.100
Nov 1, 2024 13:27:06.292296886 CET	49771	443	192.168.2.17	142.250.185.100
Nov 1, 2024 13:27:06.292330980 CET	443	49771	142.250.185.100	192.168.2.17
Nov 1, 2024 13:27:07.142734051 CET	443	49771	142.250.185.100	192.168.2.17
Nov 1, 2024 13:27:07.186990023 CET	49771	443	192.168.2.17	142.250.185.100

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 13:25:01.338867903 CET	53	55659	1.1.1.1	192.168.2.17
Nov 1, 2024 13:25:01.355221033 CET	53	58921	1.1.1.1	192.168.2.17
Nov 1, 2024 13:25:02.242471933 CET	58302	53	192.168.2.17	1.1.1.1
Nov 1, 2024 13:25:02.242717981 CET	58504	53	192.168.2.17	1.1.1.1
Nov 1, 2024 13:25:02.249037027 CET	64027	53	192.168.2.17	1.1.1.1
Nov 1, 2024 13:25:02.249205112 CET	57421	53	192.168.2.17	1.1.1.1
Nov 1, 2024 13:25:02.258842945 CET	53	58504	1.1.1.1	192.168.2.17
Nov 1, 2024 13:25:02.258857965 CET	53	58302	1.1.1.1	192.168.2.17
Nov 1, 2024 13:25:02.261123896 CET	53	57421	1.1.1.1	192.168.2.17
Nov 1, 2024 13:25:02.261818886 CET	53	64027	1.1.1.1	192.168.2.17
Nov 1, 2024 13:25:02.573023081 CET	53	56706	1.1.1.1	192.168.2.17
Nov 1, 2024 13:25:06.168483019 CET	59146	53	192.168.2.17	1.1.1.1
Nov 1, 2024 13:25:06.168634892 CET	50570	53	192.168.2.17	1.1.1.1
Nov 1, 2024 13:25:06.178400993 CET	53	59146	1.1.1.1	192.168.2.17
Nov 1, 2024 13:25:06.178419113 CET	53	50570	1.1.1.1	192.168.2.17
Nov 1, 2024 13:25:19.532613993 CET	53	55913	1.1.1.1	192.168.2.17
Nov 1, 2024 13:25:38.299954891 CET	53	63471	1.1.1.1	192.168.2.17
Nov 1, 2024 13:25:48.463887930 CET	52685	53	192.168.2.17	1.1.1.1
Nov 1, 2024 13:25:48.464143991 CET	55584	53	192.168.2.17	1.1.1.1
Nov 1, 2024 13:25:48.472860098 CET	53	52685	1.1.1.1	192.168.2.17
Nov 1, 2024 13:25:48.473892927 CET	53	55584	1.1.1.1	192.168.2.17
Nov 1, 2024 13:26:01.319205046 CET	53	64616	1.1.1.1	192.168.2.17
Nov 1, 2024 13:26:01.337001085 CET	53	62702	1.1.1.1	192.168.2.17
Nov 1, 2024 13:26:05.370177031 CET	56427	53	192.168.2.17	1.1.1.1
Nov 1, 2024 13:26:05.370322943 CET	53846	53	192.168.2.17	1.1.1.1
Nov 1, 2024 13:26:05.382380009 CET	53	53846	1.1.1.1	192.168.2.17
Nov 1, 2024 13:26:05.383354902 CET	53	56427	1.1.1.1	192.168.2.17
Nov 1, 2024 13:26:06.226546049 CET	64737	53	192.168.2.17	1.1.1.1
Nov 1, 2024 13:26:06.227016926 CET	54759	53	192.168.2.17	1.1.1.1
Nov 1, 2024 13:26:06.233556032 CET	53	64737	1.1.1.1	192.168.2.17
Nov 1, 2024 13:26:06.233573914 CET	53	54759	1.1.1.1	192.168.2.17
Nov 1, 2024 13:26:14.550961971 CET	138	138	192.168.2.17	192.168.2.255
Nov 1, 2024 13:26:29.432442904 CET	53	51983	1.1.1.1	192.168.2.17

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 1, 2024 13:25:02.242471933 CET	192.168.2.17	1.1.1.1	0x1c7f	Standard query (0)	japaneastr-notifyp.svc.ms	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:25:02.242717981 CET	192.168.2.17	1.1.1.1	0x9ea9	Standard query (0)	japaneastr-notifyp.svc.ms	65	IN (0x0001)	false
Nov 1, 2024 13:25:02.249037027 CET	192.168.2.17	1.1.1.1	0xdd7c	Standard query (0)	japaneastr-notifyp.svc.ms	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:25:02.249205112 CET	192.168.2.17	1.1.1.1	0x72dd	Standard query (0)	japaneastr-notifyp.svc.ms	65	IN (0x0001)	false
Nov 1, 2024 13:25:06.168483019 CET	192.168.2.17	1.1.1.1	0xee16	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:25:06.168634892 CET	192.168.2.17	1.1.1.1	0x9e56	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 1, 2024 13:25:48.463887930 CET	192.168.2.17	1.1.1.1	0xfca5	Standard query (0)	chrome-devtools-frontend.appspot.com	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:25:48.464143991 CET	192.168.2.17	1.1.1.1	0x8e39	Standard query (0)	chrome-devtools-frontend.appspot.com	65	IN (0x0001)	false
Nov 1, 2024 13:26:05.370177031 CET	192.168.2.17	1.1.1.1	0x9835	Standard query (0)	japaneastr-notifyp.svc.ms	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:26:05.370322943 CET	192.168.2.17	1.1.1.1	0x52d5	Standard query (0)	japaneastr-notifyp.svc.ms	65	IN (0x0001)	false
Nov 1, 2024 13:26:06.226546049 CET	192.168.2.17	1.1.1.1	0x45d7	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:26:06.227016926 CET	192.168.2.17	1.1.1.1	0xbef6	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 1, 2024 13:25:02.258842945 CET	1.1.1.1	192.168.2.17	0x9ea9	No error (0)	japaneastr-notifyp.svc.ms	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 1, 2024 13:25:02.258857965 CET	1.1.1.1	192.168.2.17	0x1c7f	No error (0)	japaneastr-notifyp.svc.ms	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 1, 2024 13:25:02.258857965 CET	1.1.1.1	192.168.2.17	0x1c7f	No error (0)	dual-spo-0005.spo-msedge.net		13.107.136.10	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:25:02.258857965 CET	1.1.1.1	192.168.2.17	0x1c7f	No error (0)	dual-spo-0005.spo-msedge.net		13.107.138.10	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:25:02.261123896 CET	1.1.1.1	192.168.2.17	0x72dd	No error (0)	japaneastr-notifyp.svc.ms	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 1, 2024 13:25:02.261818886 CET	1.1.1.1	192.168.2.17	0xdd7c	No error (0)	japaneastr-notifyp.svc.ms	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 1, 2024 13:25:02.261818886 CET	1.1.1.1	192.168.2.17	0xdd7c	No error (0)	dual-spo-0005.spo-msedge.net		13.107.136.10	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:25:02.261818886 CET	1.1.1.1	192.168.2.17	0xdd7c	No error (0)	dual-spo-0005.spo-msedge.net		13.107.138.10	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:25:06.178400993 CET	1.1.1.1	192.168.2.17	0xee16	No error (0)	www.google.com		142.250.186.68	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:25:06.178419113 CET	1.1.1.1	192.168.2.17	0x9e56	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 1, 2024 13:25:48.472860098 CET	1.1.1.1	192.168.2.17	0xfca5	No error (0)	chrome-devtools-frontend.appspot.com		142.250.186.52	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:26:05.382380009 CET	1.1.1.1	192.168.2.17	0x52d5	No error (0)	japaneastr-notifyp.svc.ms	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 1, 2024 13:26:05.383354902 CET	1.1.1.1	192.168.2.17	0x9835	No error (0)	japaneastr-notifyp.svc.ms	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 1, 2024 13:26:05.383354902 CET	1.1.1.1	192.168.2.17	0x9835	No error (0)	dual-spo-0005.spo-msedge.net		13.107.136.10	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:26:05.383354902 CET	1.1.1.1	192.168.2.17	0x9835	No error (0)	dual-spo-0005.spo-msedge.net		13.107.138.10	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:26:06.233556032 CET	1.1.1.1	192.168.2.17	0x45d7	No error (0)	www.google.com		142.250.185.100	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:26:06.233573914 CET	1.1.1.1	192.168.2.17	0xbef6	No error (0)	www.google.com			65	IN (0x0001)	false

HTTP Request Dependency Graph

japaneastr-notifyp.svc.ms

https:

slscr.update.microsoft.com

fs.microsoft.com

www.google.com

evoke-windowsservices-tas.msedge.net

www.bing.com

chrome-devtools-frontend.appspot.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.17	49700	13.107.136.10	80	2396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 1, 2024 13:25:47.272562027 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.17	49701	13.107.136.10	80	2396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 1, 2024 13:25:47.272614956 CET	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.17	49702	13.107.136.10	443	2396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:25:02 UTC	668	OUT	GET / HTTP/1.1 Host: japaneastr-notifyp.svc.ms Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 12:25:03 UTC	636	IN	HTTP/1.1 405 Method Not Allowed Cache-Control: no-cache Pragma: no-cache Allow: HEAD Content-Length: 72 Content-Type: application/json; charset=utf-8 Expires: -1 Notify-CorrelationId: df64ff8c-16a7-4f7a-bdb7-68a6a3bc033a Notify-CorrelationVector: df64ff8c-16a7-4f7a-bdb7-68a6a3bc033a-f0c595b9-7f21-407e-9799-bbe24c12cf7e Notify-ServerInfo: WEBROLE-ODSP-NO 2024-11-01T12:25:03.5596943Z X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: BC576D15971945B3984E8AD5FD29F81B Ref B: DFW311000106033 Ref C: 2024-11-01T12:25:03Z Date: Fri, 01 Nov 2024 12:25:03 GMT Connection: close
2024-11-01 12:25:03 UTC	72	IN	Data Raw: 7b 22 4d 65 73 73 61 67 65 22 3a 22 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 68 74 74 70 20 6d 65 74 68 6f 64 20 27 47 45 54 27 2e 22 7d Data Ascii: {"Message":"The requested resource does not support http method 'GET'."}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.17	49704	13.107.136.10	443	2396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:25:04 UTC	606	OUT	GET /favicon.ico HTTP/1.1 Host: japaneastr-notifyp.svc.ms Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://japaneastr-notifyp.svc.ms/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 12:25:05 UTC	283	IN	HTTP/1.1 404 Not Found Content-Length: 1245 Content-Type: text/html X-Powered-By: ASP.NET X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 8C3A4AE6D18B41C2B8CC563EAEAAFFF8 Ref B: DFW311000108049 Ref C: 2024-11-01T12:25:04Z Date: Fri, 01 Nov 2024 12:25:04 GMT Connection: close
2024-11-01 12:25:05 UTC	1245	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - Fil

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.17	49706	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:25:11 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Fhu1zghkpZcNugC&MD=TsMgzCSK HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-01 12:25:11 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 93d6752a-b681-4f6b-9b78-baabab78986a MS-RequestId: 3b5ef1aa-cab5-4000-8251-b207df82ef76 MS-CV: MBFer2yhREyF2VzI.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 01 Nov 2024 12:25:10 GMT Connection: close Content-Length: 24490
2024-11-01 12:25:11 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-01 12:25:11 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.17	49714	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:25:16 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-01 12:25:16 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=102026 Date: Fri, 01 Nov 2024 12:25:16 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.17	49715	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:25:17 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-01 12:25:17 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=102082 Date: Fri, 01 Nov 2024 12:25:17 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-01 12:25:17 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.17	49716	142.250.186.68	443	2396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:25:32 UTC	621	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIk6HLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 12:25:32 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:25:32 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-59aVZIqUWWdLFVQjeiYJKg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-01 12:25:32 UTC	112	IN	Data Raw: 39 38 35 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 73 61 6e 20 61 6e 74 6f 6e 69 6f 20 73 70 75 72 73 20 76 73 20 75 74 61 68 20 6a 61 7a 7a 20 62 6f 78 20 73 63 6f 72 65 22 2c 22 61 6d 61 72 61 6e 20 6d 6f 76 69 65 20 72 65 76 69 65 77 22 2c 22 70 65 74 65 72 20 73 74 65 72 6e 20 70 65 6c 6f 74 6f 6e 20 63 65 6f 22 2c 22 61 6d 64 20 72 Data Ascii: 985)]}'["",["san antonio spurs vs utah jazz box score","amaran movie review","peter stern peloton ceo","amd r
2024-11-01 12:25:32 UTC	1378	IN	Data Raw: 79 7a 65 6e 20 37 20 39 38 30 30 78 33 64 20 70 72 6f 63 65 73 73 6f 72 22 2c 22 70 72 61 69 72 69 65 20 67 72 6f 76 65 20 61 72 20 74 6f 72 6e 61 64 6f 20 64 61 6d 61 67 65 22 2c 22 68 6f 6e 67 20 6b 6f 6e 67 20 63 72 69 63 6b 65 74 20 73 69 78 65 73 22 2c 22 77 68 65 72 65 20 74 6f 20 62 75 79 20 6d 6f 6e 74 61 6e 61 20 6d 69 6c 6c 69 6f 6e 61 69 72 65 20 74 69 63 6b 65 74 73 22 2c 22 77 61 72 63 72 61 66 74 20 74 72 61 63 6b 69 6e 67 20 71 75 65 73 74 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 Data Ascii: yzen 7 9800x3d processor","prairie grove ar tornado damage","hong kong cricket sixes","where to buy montana millionaire tickets","warcraft tracking quest"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"Ch
2024-11-01 12:25:32 UTC	954	IN	Data Raw: 42 56 30 56 74 4e 47 64 4c 54 56 5a 61 56 6c 56 7a 55 56 46 58 51 6a 64 42 5a 6b 45 30 54 6c 6f 34 51 6c 4e 6d 61 6b 39 57 4e 6a 6b 77 64 44 4e 46 59 31 63 30 61 33 4a 73 64 56 42 48 52 55 64 52 4d 33 6c 61 56 44 6b 77 52 33 46 4c 63 30 4e 6d 52 6d 51 32 65 6e 64 6c 4f 54 4d 79 4f 57 68 77 4e 47 39 56 61 53 74 78 62 6c 67 7a 57 54 56 42 62 43 38 34 51 56 70 6f 56 48 52 35 51 6a 52 72 65 55 31 48 4e 44 4a 6d 64 45 6c 76 51 6c 42 4b 55 6e 70 76 4e 6d 4e 31 4c 7a 46 45 57 47 68 74 4e 6d 4a 78 65 56 4e 48 56 6c 42 78 55 6e 46 54 5a 54 4e 5a 55 6d 77 31 52 31 46 75 64 33 4a 48 56 44 64 4a 53 6e 4e 78 53 30 35 42 56 6e 55 77 63 57 70 75 4e 6d 31 69 54 6e 64 50 4e 44 52 7a 52 48 56 4a 54 31 52 49 52 6d 64 6b 65 48 68 5a 51 56 5a 4d 5a 45 56 71 4d 6d 56 77 4e 32 Data Ascii: BV0VtNGdLTVZaVlVzUVFXQjdBZkE0Tlo4QlNmak9WNjkwdDNFY1c0a3JsdVBHRUdRM3laVDkwR3FLc0NmRmQ2endlOTMyOWhwNG9VaStxblgzWTVBbC84QVpoVHR5QjRreU1HNDJmdElvQlBKUnpvNmN1LzFEWGhtNmJxeVNHVlBxUnFTZTNZUmw1R1Fud3JHVDdJSnNxS05BVnUwcWpuNm1iTndPNDRzRHVJT1RIRmdkeHhZQVZMZEVqMmVwN2
2024-11-01 12:25:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.17	49717	13.107.136.10	443	2396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:25:37 UTC	694	OUT	GET / HTTP/1.1 Host: japaneastr-notifyp.svc.ms Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 12:25:37 UTC	636	IN	HTTP/1.1 405 Method Not Allowed Cache-Control: no-cache Pragma: no-cache Allow: HEAD Content-Length: 72 Content-Type: application/json; charset=utf-8 Expires: -1 Notify-CorrelationId: ddda3c1b-8ee2-4437-861b-c5a7f8c65f85 Notify-CorrelationVector: ddda3c1b-8ee2-4437-861b-c5a7f8c65f85-94c2fd66-f40d-4d29-a5a0-10426384e3e0 Notify-ServerInfo: WEBROLE-ODSP-NO 2024-11-01T12:25:37.8594109Z X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 4AF86052A10D446282032B25CED9731F Ref B: DFW311000105047 Ref C: 2024-11-01T12:25:37Z Date: Fri, 01 Nov 2024 12:25:36 GMT Connection: close
2024-11-01 12:25:37 UTC	72	IN	Data Raw: 7b 22 4d 65 73 73 61 67 65 22 3a 22 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 68 74 74 70 20 6d 65 74 68 6f 64 20 27 47 45 54 27 2e 22 7d Data Ascii: {"Message":"The requested resource does not support http method 'GET'."}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.17	49719	20.190.160.14	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:25:38 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-01 12:25:38 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-01 12:25:38 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 01 Nov 2024 12:24:38 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BAY x-ms-request-id: da8716ad-1847-42b7-8d31-13068001f374 PPServer: PPV: 30 H: PH1PEPF00011F3C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 01 Nov 2024 12:25:38 GMT Connection: close Content-Length: 11392
2024-11-01 12:25:38 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.17	49720	13.107.5.88	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:25:38 UTC	537	OUT	GET /ab HTTP/1.1 Host: evoke-windowsservices-tas.msedge.net Cache-Control: no-store, no-cache X-PHOTOS-CALLERID: 9NMPJ99VJBWV X-EVOKE-RING: X-WINNEXT-RING: Public X-WINNEXT-TELEMETRYLEVEL: Basic X-WINNEXT-OSVERSION: 10.0.19045.0 X-WINNEXT-APPVERSION: 1.23082.131.0 X-WINNEXT-PLATFORM: Desktop X-WINNEXT-CANTAILOR: False X-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd} X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI= If-None-Match: 2056388360_-1434155563 Accept-Encoding: gzip, deflate, br
2024-11-01 12:25:38 UTC	209	IN	HTTP/1.1 400 Bad Request X-MSEdge-Ref: Ref A: 659839E863EE48FAA9BD59D091DA94D0 Ref B: DFW311000106029 Ref C: 2024-11-01T12:25:38Z Date: Fri, 01 Nov 2024 12:25:37 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.17	49721	20.190.160.14	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:25:39 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-01 12:25:39 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-01 12:25:40 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 01 Nov 2024 12:24:39 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BAY x-ms-request-id: d16fbc6f-3885-4e1c-befd-98af445b97a0 PPServer: PPV: 30 H: PH1PEPF0001B8A0 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 01 Nov 2024 12:25:39 GMT Connection: close Content-Length: 11392
2024-11-01 12:25:40 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.17	49722	20.190.160.14	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:25:41 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-01 12:25:41 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-01 12:25:41 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 01 Nov 2024 12:24:41 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BAY x-ms-request-id: 61546c91-e41b-4261-860c-79f9ca54a922 PPServer: PPV: 30 H: PH1PEPF0001B6CD V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 01 Nov 2024 12:25:40 GMT Connection: close Content-Length: 11392
2024-11-01 12:25:41 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.17	49723	20.190.160.14	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:25:43 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4808 Host: login.live.com
2024-11-01 12:25:43 UTC	4808	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-01 12:25:44 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 01 Nov 2024 12:24:44 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BAY x-ms-request-id: 460a372c-2be9-4f08-a174-3f8646cccf20 PPServer: PPV: 30 H: PH1PEPF00011E56 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 01 Nov 2024 12:25:43 GMT Connection: close Content-Length: 11197
2024-11-01 12:25:44 UTC	11197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.17	49724	92.123.104.21	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:25:45 UTC	2571	OUT	GET /client/config?cc=CH&setlang=en-CH HTTP/1.1 X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-UserAgeClass: Unknown X-BM-Market: CH X-BM-DateFormat: dd/MM/yyyy X-Device-OSSKU: 48 X-BM-DTZ: -240 X-DeviceID: 01000A41090080B6 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDoAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAXnD9znpb9bazssWWcPEhbKTEo4EBraWqNQxbbxr4OXSdctfq1/JUmuJ23/W8X1Ol1ksdsm9ppva66Iui1zF1XKBMs0O6/3e/ESB4ofDAdl2k9F1um7SbjWwIHRXjLnjd2N95FjSZYkAJSTKSsSWmEjKtEWUxpHrbrC8/v8T4n54H0jRSzYwsgI/YP8VgkkCOKJZXdg8tBVILn2CC9tLLyj4NNvtiSVhZsJ2M6SulpNtEiP2vHAb6cQFncivv8Hjfp%2B7aiQnGIS18tV5%2B3Kw9RsKohINVw3nBH9thB4/OkQ/rsZqw7zKUVdxNg1gXseT5PIdc5c41doB52yeWQHs2YwQZgAAENtwR4UZiZM3KgxitKz5lL6wAYfDiE4EJ4HycjR/LAMozl5XpdOZJDblNSW7Hxg436ui/C0IzPzwTksZnfbTogiUxeV1wRN/UpPaKJ9z8vL4oVi%2BWCeMsNra4Fp3VsLhmYA9U7SO5ihs7j4KlZSbYOKgFhMC79t9VQNeEAmS6r8mW7W0ZV2yl9j%2B821mGBaUlrEsibAekRDBPVkSpuhnDBCn7b4sJaO1OddT15AKAzJ6LBHfrsH4UejQFFfYByXDWOB0En9puA8E9W6h1jDSaR0Cf2fcFnt38KvDrrM%2BLENIHYTCX1onMcUNSAHfstJczxmL3gdezpInxVGR0RETrSKjDPPgigHq3s%2B2wtbyNbGYGPl9tpcPeXpn06eEobYwLygtsDNh0JVZP5LOknQlerJpOJSvxWtVbL/LSJ26wDD076MS7VPqkJklzL0cu8fNIDPLuMbhXhgHmK/Z1N2utMCnajGjHRnTWjTGEeOi0XIYcEP3KIFJhnm1uYCO8tQsSAeWTIhcwr32FqbgJnZ/pIXPAkUQCWnGB5z6Y1LKyiSFnL0aU8wCs8inUv%2Bea40njCEgiWJ3LsmPxvGUnLR9JOh [TRUNCATED] X-Agent-DeviceId: 01000A41090080B6 X-BM-CBT: 1730463935 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 X-Device-isOptin: false Accept-language: en-GB, en, en-US X-Device-Touch: false X-Device-ClientSession: 94019375A7EB4214A741A5FAF82576CA X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI Host: www.bing.com Connection: Keep-Alive Cookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
2024-11-01 12:25:45 UTC	1148	IN	HTTP/1.1 200 OK Content-Length: 2215 Content-Type: application/json; charset=utf-8 Cache-Control: private X-EventID: 6724c8c9bb504e83831f2368346f4272 X-AS-SetSessionMarket: de-ch UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Fri, 01 Nov 2024 12:25:45 GMT Connection: close Set-Cookie: _EDGE_S=SID=068FCE51EE106F7A2927DB7BEF656E52&mkt=de-ch; domain=.bing.com; path=/; HttpOnly Set-Cookie: ANON=A=84BEA1DAAAB85FA790252CDAFFFFFFFF; domain=.bing.com; expires=Wed, 26-Nov-2025 12:25:45 GMT; path=/; secure; SameSite=None Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/; secure; SameSite=None Set-Cookie: _SS=SID=068FCE51EE106F7A2927DB7BEF656E52; domain=.bing.com; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.88a72917.1730463945.1983b62e
2024-11-01 12:25:45 UTC	2215	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 46 65 61 74 75 72 65 43 6f 6e 66 69 67 22 3a 7b 22 53 65 61 72 63 68 42 6f 78 49 62 65 61 6d 50 6f 69 6e 74 65 72 4f 6e 48 6f 76 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 68 6f 77 53 65 61 72 63 68 47 6c 79 70 68 4c 65 66 74 4f 66 53 65 61 72 63 68 42 6f 78 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 55 73 65 53 65 61 72 63 68 49 63 6f 6e 41 74 52 65 73 74 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 75 74 74 6f 6e 55 73 65 53 65 61 72 63 68 49 63 6f 6e 22 3a 7b 22 76 61 6c 75 65 Data Ascii: {"version":1,"config":{"FeatureConfig":{"SearchBoxIbeamPointerOnHover":{"value":true,"feature":""},"ShowSearchGlyphLeftOfSearchBox":{"value":true,"feature":""},"SearchBoxUseSearchIconAtRest":{"value":false,"feature":""},"SearchButtonUseSearchIcon":{"value

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.17	49727	142.250.186.52	443	2396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:25:49 UTC	460	OUT	GET /serve_file/@e3344ddefa12e60436fa28c81cf207c1afb4d0a9/third_party/vscode.web-custom-data/browsers.css-data.json HTTP/1.1 Host: chrome-devtools-frontend.appspot.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 12:25:49 UTC	364	IN	HTTP/1.1 200 OK Content-Type: application/json Vary: Accept-Encoding Cache-Control: public, max-age=604800 Access-Control-Allow-Origin: * X-Cloud-Trace-Context: 3a76c5b3d278edfd06bfe6434f9f9151 Date: Fri, 01 Nov 2024 12:25:49 GMT Server: Google Frontend Content-Length: 520666 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-01 12:25:49 UTC	1014	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2e 31 2c 22 70 72 6f 70 65 72 74 69 65 73 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 61 64 64 69 74 69 76 65 2d 73 79 6d 62 6f 6c 73 22 2c 22 62 72 6f 77 73 65 72 73 22 3a 5b 22 46 46 33 33 22 5d 2c 22 73 79 6e 74 61 78 22 3a 22 5b 20 3c 69 6e 74 65 67 65 72 3e 20 26 26 20 3c 73 79 6d 62 6f 6c 3e 20 5d 23 22 2c 22 72 65 6c 65 76 61 6e 63 65 22 3a 35 30 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 40 63 6f 75 6e 74 65 72 2d 73 74 79 6c 65 20 64 65 73 63 72 69 70 74 6f 72 2e 20 53 70 65 63 69 66 69 65 73 20 74 68 65 20 73 79 6d 62 6f 6c 73 20 75 73 65 64 20 62 79 20 74 68 65 20 6d 61 72 6b 65 72 2d 63 6f 6e 73 74 72 75 63 74 69 6f 6e 20 61 6c 67 6f 72 69 74 68 6d 20 73 70 65 63 69 66 69 65 64 20 62 79 20 74 68 65 20 73 79 73 Data Ascii: {"version":1.1,"properties":[{"name":"additive-symbols","browsers":["FF33"],"syntax":"[ <integer> && <symbol> ]#","relevance":50,"description":"@counter-style descriptor. Specifies the symbols used by the marker-construction algorithm specified by the sys
2024-11-01 12:25:49 UTC	1378	IN	Data Raw: 72 65 74 63 68 20 74 6f 20 74 61 6b 65 20 75 70 20 74 68 65 20 72 65 6d 61 69 6e 69 6e 67 20 73 70 61 63 65 2e 22 7d 5d 2c 22 73 79 6e 74 61 78 22 3a 22 6e 6f 72 6d 61 6c 20 7c 20 3c 62 61 73 65 6c 69 6e 65 2d 70 6f 73 69 74 69 6f 6e 3e 20 7c 20 3c 63 6f 6e 74 65 6e 74 2d 64 69 73 74 72 69 62 75 74 69 6f 6e 3e 20 7c 20 3c 6f 76 65 72 66 6c 6f 77 2d 70 6f 73 69 74 69 6f 6e 3e 3f 20 3c 63 6f 6e 74 65 6e 74 2d 70 6f 73 69 74 69 6f 6e 3e 22 2c 22 72 65 6c 65 76 61 6e 63 65 22 3a 36 34 2c 22 72 65 66 65 72 65 6e 63 65 73 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 4d 44 4e 20 52 65 66 65 72 65 6e 63 65 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 64 65 76 65 6c 6f 70 65 72 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 64 6f 63 73 2f 57 65 62 2f 43 53 53 2f 61 6c 69 67 Data Ascii: retch to take up the remaining space."}],"syntax":"normal \| <baseline-position> \| <content-distribution> \| <overflow-position>? <content-position>","relevance":64,"references":[{"name":"MDN Reference","url":"https://developer.mozilla.org/docs/Web/CSS/alig
2024-11-01 12:25:49 UTC	1378	IN	Data Raw: 6f 73 69 74 69 6f 6e 3e 3f 20 3c 73 65 6c 66 2d 70 6f 73 69 74 69 6f 6e 3e 20 5d 22 2c 22 72 65 6c 65 76 61 6e 63 65 22 3a 38 36 2c 22 72 65 66 65 72 65 6e 63 65 73 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 4d 44 4e 20 52 65 66 65 72 65 6e 63 65 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 64 65 76 65 6c 6f 70 65 72 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 64 6f 63 73 2f 57 65 62 2f 43 53 53 2f 61 6c 69 67 6e 2d 69 74 65 6d 73 22 7d 5d 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 41 6c 69 67 6e 73 20 66 6c 65 78 20 69 74 65 6d 73 20 61 6c 6f 6e 67 20 74 68 65 20 63 72 6f 73 73 20 61 78 69 73 20 6f 66 20 74 68 65 20 63 75 72 72 65 6e 74 20 6c 69 6e 65 20 6f 66 20 74 68 65 20 66 6c 65 78 20 63 6f 6e 74 61 69 6e 65 72 2e 22 2c 22 72 65 73 74 72 69 63 74 69 Data Ascii: osition>? <self-position> ]","relevance":86,"references":[{"name":"MDN Reference","url":"https://developer.mozilla.org/docs/Web/CSS/align-items"}],"description":"Aligns flex items along the cross axis of the current line of the flex container.","restricti
2024-11-01 12:25:49 UTC	1378	IN	Data Raw: 73 79 6e 74 61 78 22 3a 22 6e 6f 72 6d 61 6c 20 7c 20 73 74 72 65 74 63 68 20 7c 20 3c 62 61 73 65 6c 69 6e 65 2d 70 6f 73 69 74 69 6f 6e 3e 20 7c 20 3c 6f 76 65 72 66 6c 6f 77 2d 70 6f 73 69 74 69 6f 6e 3e 3f 20 5b 20 3c 73 65 6c 66 2d 70 6f 73 69 74 69 6f 6e 3e 20 7c 20 6c 65 66 74 20 7c 20 72 69 67 68 74 20 5d 20 7c 20 6c 65 67 61 63 79 20 7c 20 6c 65 67 61 63 79 20 26 26 20 5b 20 6c 65 66 74 20 7c 20 72 69 67 68 74 20 7c 20 63 65 6e 74 65 72 20 5d 22 2c 22 72 65 6c 65 76 61 6e 63 65 22 3a 35 33 2c 22 72 65 66 65 72 65 6e 63 65 73 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 4d 44 4e 20 52 65 66 65 72 65 6e 63 65 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 64 65 76 65 6c 6f 70 65 72 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 64 6f 63 73 2f 57 65 62 2f 43 53 Data Ascii: syntax":"normal \| stretch \| <baseline-position> \| <overflow-position>? [ <self-position> \| left \| right ] \| legacy \| legacy && [ left \| right \| center ]","relevance":53,"references":[{"name":"MDN Reference","url":"https://developer.mozilla.org/docs/Web/CS
2024-11-01 12:25:49 UTC	1378	IN	Data Raw: 20 73 69 7a 65 20 70 72 6f 70 65 72 74 79 20 6f 66 20 74 68 65 20 66 6c 65 78 20 69 74 65 6d 20 63 6f 6d 70 75 74 65 73 20 74 6f 20 61 75 74 6f 2c 20 61 6e 64 20 6e 65 69 74 68 65 72 20 6f 66 20 74 68 65 20 63 72 6f 73 73 2d 61 78 69 73 20 6d 61 72 67 69 6e 73 20 61 72 65 20 61 75 74 6f 2c 20 74 68 65 20 66 6c 65 78 20 69 74 65 6d 20 69 73 20 73 74 72 65 74 63 68 65 64 2e 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 73 61 76 65 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 75 6e 73 61 76 65 22 7d 5d 2c 22 73 79 6e 74 61 78 22 3a 22 61 75 74 6f 20 7c 20 6e 6f 72 6d 61 6c 20 7c 20 73 74 72 65 74 63 68 20 7c 20 3c 62 61 73 65 6c 69 6e 65 2d 70 6f 73 69 74 69 6f 6e 3e 20 7c 20 3c 6f 76 65 72 66 6c 6f 77 2d 70 6f 73 69 74 69 6f 6e 3e 3f 20 5b 20 3c 73 65 6c 66 2d 70 6f 73 69 74 Data Ascii: size property of the flex item computes to auto, and neither of the cross-axis margins are auto, the flex item is stretched."},{"name":"save"},{"name":"unsave"}],"syntax":"auto \| normal \| stretch \| <baseline-position> \| <overflow-position>? [ <self-posit
2024-11-01 12:25:50 UTC	1378	IN	Data Raw: 22 73 74 72 65 74 63 68 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 49 66 20 74 68 65 20 63 72 6f 73 73 20 73 69 7a 65 20 70 72 6f 70 65 72 74 79 20 6f 66 20 74 68 65 20 66 6c 65 78 20 69 74 65 6d 20 63 6f 6d 70 75 74 65 73 20 74 6f 20 61 75 74 6f 2c 20 61 6e 64 20 6e 65 69 74 68 65 72 20 6f 66 20 74 68 65 20 63 72 6f 73 73 2d 61 78 69 73 20 6d 61 72 67 69 6e 73 20 61 72 65 20 61 75 74 6f 2c 20 74 68 65 20 66 6c 65 78 20 69 74 65 6d 20 69 73 20 73 74 72 65 74 63 68 65 64 2e 22 7d 5d 2c 22 73 79 6e 74 61 78 22 3a 22 61 75 74 6f 20 7c 20 6e 6f 72 6d 61 6c 20 7c 20 73 74 72 65 74 63 68 20 7c 20 3c 62 61 73 65 6c 69 6e 65 2d 70 6f 73 69 74 69 6f 6e 3e 20 7c 20 3c 6f 76 65 72 66 6c 6f 77 2d 70 6f 73 69 74 69 6f 6e 3e 3f 20 3c 73 65 6c 66 2d 70 6f 73 69 Data Ascii: "stretch","description":"If the cross size property of the flex item computes to auto, and neither of the cross-axis margins are auto, the flex item is stretched."}],"syntax":"auto \| normal \| stretch \| <baseline-position> \| <overflow-position>? <self-posi
2024-11-01 12:25:50 UTC	1378	IN	Data Raw: 20 6e 6f 72 6d 61 6c 20 64 69 72 65 63 74 69 6f 6e 2c 20 61 6e 64 20 74 68 65 20 61 6e 69 6d 61 74 69 6f 6e 20 63 79 63 6c 65 20 69 74 65 72 61 74 69 6f 6e 73 20 74 68 61 74 20 61 72 65 20 65 76 65 6e 20 63 6f 75 6e 74 73 20 61 72 65 20 70 6c 61 79 65 64 20 69 6e 20 61 20 72 65 76 65 72 73 65 20 64 69 72 65 63 74 69 6f 6e 2e 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 61 6c 74 65 72 6e 61 74 65 2d 72 65 76 65 72 73 65 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 68 65 20 61 6e 69 6d 61 74 69 6f 6e 20 63 79 63 6c 65 20 69 74 65 72 61 74 69 6f 6e 73 20 74 68 61 74 20 61 72 65 20 6f 64 64 20 63 6f 75 6e 74 73 20 61 72 65 20 70 6c 61 79 65 64 20 69 6e 20 74 68 65 20 72 65 76 65 72 73 65 20 64 69 72 65 63 74 69 6f 6e 2c 20 61 6e 64 20 74 68 65 20 61 6e 69 6d Data Ascii: normal direction, and the animation cycle iterations that are even counts are played in a reverse direction."},{"name":"alternate-reverse","description":"The animation cycle iterations that are odd counts are played in the reverse direction, and the anim
2024-11-01 12:25:50 UTC	1378	IN	Data Raw: 63 74 69 6f 6e 22 2c 22 65 6e 75 6d 22 2c 22 69 64 65 6e 74 69 66 69 65 72 22 2c 22 6e 75 6d 62 65 72 22 5d 7d 2c 7b 22 6e 61 6d 65 22 3a 22 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 22 2c 22 62 72 6f 77 73 65 72 73 22 3a 5b 22 45 31 32 22 2c 22 46 46 31 36 22 2c 22 53 39 22 2c 22 43 34 33 22 2c 22 49 45 31 30 22 2c 22 4f 33 30 22 5d 2c 22 73 79 6e 74 61 78 22 3a 22 3c 74 69 6d 65 3e 23 22 2c 22 72 65 6c 65 76 61 6e 63 65 22 3a 36 35 2c 22 72 65 66 65 72 65 6e 63 65 73 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 4d 44 4e 20 52 65 66 65 72 65 6e 63 65 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 64 65 76 65 6c 6f 70 65 72 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 64 6f 63 73 2f 57 65 62 2f 43 53 53 2f 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 22 7d 5d 2c Data Ascii: ction","enum","identifier","number"]},{"name":"animation-delay","browsers":["E12","FF16","S9","C43","IE10","O30"],"syntax":"<time>#","relevance":65,"references":[{"name":"MDN Reference","url":"https://developer.mozilla.org/docs/Web/CSS/animation-delay"}],
2024-11-01 12:25:50 UTC	1378	IN	Data Raw: 73 22 3a 5b 22 45 31 32 22 2c 22 46 46 31 36 22 2c 22 53 39 22 2c 22 43 34 33 22 2c 22 49 45 31 30 22 2c 22 4f 33 30 22 5d 2c 22 73 79 6e 74 61 78 22 3a 22 3c 74 69 6d 65 3e 23 22 2c 22 72 65 6c 65 76 61 6e 63 65 22 3a 37 31 2c 22 72 65 66 65 72 65 6e 63 65 73 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 4d 44 4e 20 52 65 66 65 72 65 6e 63 65 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 64 65 76 65 6c 6f 70 65 72 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 64 6f 63 73 2f 57 65 62 2f 43 53 53 2f 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 22 7d 5d 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 44 65 66 69 6e 65 73 20 74 68 65 20 6c 65 6e 67 74 68 20 6f 66 20 74 69 6d 65 20 74 68 61 74 20 61 6e 20 61 6e 69 6d 61 74 69 6f 6e 20 74 61 6b 65 73 20 74 6f 20 Data Ascii: s":["E12","FF16","S9","C43","IE10","O30"],"syntax":"<time>#","relevance":71,"references":[{"name":"MDN Reference","url":"https://developer.mozilla.org/docs/Web/CSS/animation-duration"}],"description":"Defines the length of time that an animation takes to
2024-11-01 12:25:50 UTC	1378	IN	Data Raw: 2c 22 43 34 33 22 2c 22 49 45 31 30 22 2c 22 4f 33 30 22 5d 2c 22 76 61 6c 75 65 73 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 69 6e 66 69 6e 69 74 65 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 43 61 75 73 65 73 20 74 68 65 20 61 6e 69 6d 61 74 69 6f 6e 20 74 6f 20 72 65 70 65 61 74 20 66 6f 72 65 76 65 72 2e 22 7d 5d 2c 22 73 79 6e 74 61 78 22 3a 22 3c 73 69 6e 67 6c 65 2d 61 6e 69 6d 61 74 69 6f 6e 2d 69 74 65 72 61 74 69 6f 6e 2d 63 6f 75 6e 74 3e 23 22 2c 22 72 65 6c 65 76 61 6e 63 65 22 3a 36 33 2c 22 72 65 66 65 72 65 6e 63 65 73 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 4d 44 4e 20 52 65 66 65 72 65 6e 63 65 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 64 65 76 65 6c 6f 70 65 72 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 64 6f 63 73 2f 57 65 62 2f 43 Data Ascii: ,"C43","IE10","O30"],"values":[{"name":"infinite","description":"Causes the animation to repeat forever."}],"syntax":"<single-animation-iteration-count>#","relevance":63,"references":[{"name":"MDN Reference","url":"https://developer.mozilla.org/docs/Web/C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.17	49728	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:25:49 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Fhu1zghkpZcNugC&MD=TsMgzCSK HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-01 12:25:49 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 137482b6-420c-4a5a-a153-b5fc5995eeac MS-RequestId: 957d9d2d-703f-4b40-bf1f-d28c99117849 MS-CV: yJ2P+/4Qj0afErbX.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 01 Nov 2024 12:25:49 GMT Connection: close Content-Length: 30005
2024-11-01 12:25:49 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-01 12:25:49 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.17	49732	142.250.186.68	443	2396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:25:56 UTC	621	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIk6HLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.17	49718	13.107.136.10	443	2396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:25:57 UTC	711	OUT	GET / HTTP/1.1 Host: japaneastr-notifyp.svc.ms Connection: keep-alive Pragma: no-cache Cache-Control: no-cache sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 12:25:57 UTC	636	IN	HTTP/1.1 405 Method Not Allowed Cache-Control: no-cache Pragma: no-cache Allow: HEAD Content-Length: 72 Content-Type: application/json; charset=utf-8 Expires: -1 Notify-CorrelationId: 6f7955c4-e189-4c8f-80ca-b68655a7e93f Notify-CorrelationVector: 6f7955c4-e189-4c8f-80ca-b68655a7e93f-ec6af1bb-e4ae-49cc-a20c-0698c5856b01 Notify-ServerInfo: WEBROLE-ODSP-NO 2024-11-01T12:25:57.6854337Z X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 1E94AB0774224FABAFF4876B3BE0098E Ref B: DFW311000106035 Ref C: 2024-11-01T12:25:57Z Date: Fri, 01 Nov 2024 12:25:57 GMT Connection: close
2024-11-01 12:25:57 UTC	72	IN	Data Raw: 7b 22 4d 65 73 73 61 67 65 22 3a 22 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 68 74 74 70 20 6d 65 74 68 6f 64 20 27 47 45 54 27 2e 22 7d Data Ascii: {"Message":"The requested resource does not support http method 'GET'."}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.17	49733	13.107.136.10	443	2396	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:26:05 UTC	711	OUT	GET / HTTP/1.1 Host: japaneastr-notifyp.svc.ms Connection: keep-alive Pragma: no-cache Cache-Control: no-cache sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 12:26:06 UTC	636	IN	HTTP/1.1 405 Method Not Allowed Cache-Control: no-cache Pragma: no-cache Allow: HEAD Content-Length: 72 Content-Type: application/json; charset=utf-8 Expires: -1 Notify-CorrelationId: 5a2a8326-b45b-4014-9879-f57acff92788 Notify-CorrelationVector: 5a2a8326-b45b-4014-9879-f57acff92788-170ed980-85c6-4dad-9a9c-27aa33ea6040 Notify-ServerInfo: WEBROLE-ODSP-NO 2024-11-01T12:26:05.9401429Z X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 7FF374701E0B414A8CDC670CCFFCD5F4 Ref B: DFW311000102029 Ref C: 2024-11-01T12:26:05Z Date: Fri, 01 Nov 2024 12:26:05 GMT Connection: close
2024-11-01 12:26:06 UTC	72	IN	Data Raw: 7b 22 4d 65 73 73 61 67 65 22 3a 22 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 68 74 74 70 20 6d 65 74 68 6f 64 20 27 47 45 54 27 2e 22 7d Data Ascii: {"Message":"The requested resource does not support http method 'GET'."}

Target ID:	0
Start time:	08:24:59
Start date:	01/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	08:25:00
Start date:	01/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1948,i,5061841531020221121,2327678435773558814,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	08:25:01
Start date:	01/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://japaneastr-notifyp.svc.ms"
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://japaneastr-notifyp.svc.ms

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Static File Info

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 600, Parent PID: 5976

Windows Analysis Report
http://japaneastr-notifyp.svc.ms